The implementing regulation of Indonesia's Personal Data Protection Law is out. Breaches must be reported within 3×24 hours; fines reach 2% of revenue.
Two years after Law No. 27 of 2022 on Personal Data Protection (the PDP Law) came fully into force, its implementing rules have finally arrived. Government Regulation No. 33 of 2026 was promulgated on 16 July 2026 and takes effect on 16 January 2027. Any business collecting customer data through a website — contact forms, accounts, orders — needs to prepare.
Key points of PP 33/2026
| Provision | Summary |
|---|---|
| Breach notification | Required to data subjects and the supervisory authority within 3×24 hours of the breach being confirmed. |
| Impact assessment (DPIA) | Required before high-risk personal data processing. |
| Data protection officer (DPO) | Must be appointed in certain cases. |
| Administrative sanctions | Can include fines of up to 2% of annual revenue. |
| Children's data | Regulated in more detail, including parent/guardian consent. |
The regulation has 225 articles. Summaries are available from Verihubs and Katadata (in Indonesian).
The supervisory authority does not exist yet
The PDP Law requires a dedicated data protection authority. By the end of October 2026 it had still not been formed — Kompas urged its prompt creation, and the issue has also been taken to the Constitutional Court. In the meantime the Ministry of Communication and Digital Affairs (Komdigi) carries out supervision.
PSE obligations are being enforced
Komdigi is also enforcing Electronic System Operator (PSE) registration: 25 private operators received warning letters with a 22 September 2026 deadline and the threat of blocking.
Why it is urgent
According to Surfshark data summarised by Databoks, about 1.22 million Indonesian accounts were breached in the first half of 2026 — the highest in Southeast Asia. From 2027, a breach is no longer only a reputational problem but a legal obligation with a tight deadline.
Checklist before January 2027
- Map your data: what personal data your website collects, why, and where it is stored (hosting, email, spreadsheets, third-party apps).
- Privacy policy: publish a clear page and ask for consent before collecting data.
- Limit access: only people who need customer data should be able to open it; enable two-step verification.
- Secure connections: use HTTPS on every page and keep your CMS and plugins updated.
- Breach response plan: who decides, who to contact, and a notification template so the 3×24-hour deadline can be met.
- Delete what you don't need: data no longer in use should be deleted, not kept forever.
Sources
- PP Pelindungan Data Pribadi berlaku Januari 2027 — Katadata — katadata.co.id
- Ringkasan PP 33 Tahun 2026 — Verihubs — verihubs.com
- Segera bentuk badan pelindungan data pribadi — Kompas — nasional.kompas.com
- Komdigi surati 25 PSE untuk penuhi kewajiban pendaftaran — Fortune Indonesia — fortuneidn.com
- Indonesia records highest data breaches in Southeast Asia in H1 2026 — Databoks — databoks.katadata.co.id
Written from the sources above as of 31 October 2026. Third-party policies and figures can change — check the original sources for the latest.
All news